@aphexcms/cms-core 8.0.0 → 9.0.0

package/dist/storage/adapters/local-storage-adapter.js

@@ -1,6 +1,6 @@
 // Pure local file system storage adapter - no database operations
 import { writeFile, mkdir, unlink, stat, readdir } from 'fs/promises';
-import { join, dirname } from 'path';
+import { join, dirname, resolve, basename } from 'path';
 import { cmsLogger } from '../../utils/logger.js';
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
 /**
@@ -17,12 +17,19 @@ export class LocalStorageAdapter {
             options: config.options || {}
         };
     }
+    /**
+     * Strip path traversal sequences, keeping only the base filename.
+     */
+    sanitizeFilename(filename) {
+        return basename(filename).replace(/^\.+/, '_');
+    }
     /**
      * Generate unique filename preserving original name
      */
     async generateUniqueFilename(originalFilename) {
-        const { name, ext } = this.parseFilename(originalFilename);
-        let filename = originalFilename;
+        const safe = this.sanitizeFilename(originalFilename);
+        const { name, ext } = this.parseFilename(safe);
+        let filename = safe;
         let counter = 1;
         // Check if file exists on disk
         while (await this.fileExistsOnDisk(filename)) {
@@ -92,15 +99,25 @@ export class LocalStorageAdapter {
      * Used by API endpoint to serve files
      */
     async getObject(path) {
+        const resolved = resolve(path);
+        const base = resolve(this.config.basePath);
+        if (!resolved.startsWith(base + '/') && resolved !== base) {
+            throw new Error('Access denied: path outside storage directory');
+        }
         const { readFile } = await import('fs/promises');
-        return await readFile(path);
+        return await readFile(resolved);
     }
     /**
      * Delete a file from storage
      */
     async delete(path) {
         try {
-            await unlink(path);
+            const resolved = resolve(path);
+            const base = resolve(this.config.basePath);
+            if (!resolved.startsWith(base + '/') && resolved !== base) {
+                throw new Error('Access denied: path outside storage directory');
+            }
+            await unlink(resolved);
             return true;
         }
         catch (error) {
@@ -113,7 +130,12 @@ export class LocalStorageAdapter {
      */
     async exists(path) {
         try {
-            await stat(path);
+            const resolved = resolve(path);
+            const base = resolve(this.config.basePath);
+            if (!resolved.startsWith(base + '/') && resolved !== base) {
+                return false;
+            }
+            await stat(resolved);
             return true;
         }
         catch {

package/dist/types/capabilities.d.ts

@@ -61,6 +61,7 @@ export interface NewRole {
  * Used by migration, org-creation, and the runtime seeder.
  */
 export declare function buildBuiltinRoleRows(organizationId: string): NewRole[];
+export declare function isInstanceRole(auth: Auth): boolean;
 /**
  * Check whether an Auth already has a capability.
  *

package/dist/types/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/lib/types/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAEnB,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GAEpB,YAAY,GACZ,cAAc,GACd,cAAc,GAEd,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,CAAC;AAMlB;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAgBxC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKzD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACrC,gBAAgB,EAChB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CA4C5D,CAAC;AAeF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAK/E;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,CAQtE;AAWD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAoCvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAInE;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,UAAU,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/lib/types/capabilities.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAEnB,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GAEpB,YAAY,GACZ,cAAc,GACd,cAAc,GAEd,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,CAAC;AAMlB;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAgBxC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAKzD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACrC,gBAAgB,EAChB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CA4C5D,CAAC;AAeF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAK/E;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,CAQtE;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAoCvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAInE;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,YAAY,EAAE,UAAU,EAAE,CAAC;CAC3B"}

package/dist/types/capabilities.js

@@ -143,6 +143,9 @@ export function buildBuiltinRoleRows(organizationId) {
  * even if an admin accidentally locks their own role down.
  */
 const INSTANCE_ROLE_OVERRIDES = new Set(['super_admin', 'admin']);
+export function isInstanceRole(auth) {
+    return auth.type === 'session' && INSTANCE_ROLE_OVERRIDES.has(auth.user.role);
+}
 /**
  * Check whether an Auth already has a capability.
  *

package/dist/types/config.d.ts

@@ -7,6 +7,7 @@ import type { EmailAdapter } from '../email/index.js';
 import type { GraphQLConfig } from '../graphql/index.js';
 import type { AphexEnv } from '../server/api/index.js';
 import type { SchemaType } from './schemas.js';
+import type { Logger } from '../utils/logger.js';
 export type { GraphQLConfig };
 export interface CMSConfig {
     schemaTypes: SchemaType[];
@@ -32,9 +33,23 @@ export interface CMSConfig {
      */
     graphql?: boolean | GraphQLConfig;
     /**
-     * Log level for CMS output. Defaults to 'debug' in dev, 'warn' in production.
+     * Log level for the built-in console logger. Defaults to 'debug' in dev, 'warn' in production.
+     * Ignored when a custom `logger` is provided.
      */
     logLevel?: 'debug' | 'info' | 'warn' | 'error' | 'none';
+    /**
+     * Custom logger instance (e.g. pino). Must implement debug/info/warn/error.
+     * When provided, replaces the built-in console logger entirely.
+     *
+     * @example
+     * ```ts
+     * import pino from 'pino';
+     * export default createCMSConfig({
+     *   logger: pino({ level: 'info' }),
+     * });
+     * ```
+     */
+    logger?: Logger;
     auth?: {
         provider: AuthProvider;
         loginUrl?: string;

package/dist/types/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/types/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B,MAAM,WAAW,SAAS;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE;YACV,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,KAAK,CAAC,EAAE;YACP,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC/B,CAAC;KACF,CAAC;IACF;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IAClC;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACxD,IAAI,CAAC,EAAE;QACN,QAAQ,EAAE,YAAY,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,EAAE;QACV;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;CACpC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/types/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B,MAAM,WAAW,SAAS;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE;YACV,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,KAAK,CAAC,EAAE;YACP,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC/B,CAAC;KACF,CAAC;IACF;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACxD;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACN,QAAQ,EAAE,YAAY,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,EAAE;QACV;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;CACpC"}

package/dist/utils/logger.d.ts

@@ -1,9 +1,11 @@
 export type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'none';
+export interface Logger {
+    debug(...args: any[]): void;
+    info(...args: any[]): void;
+    warn(...args: any[]): void;
+    error(...args: any[]): void;
+}
 export declare function setLogLevel(level: LogLevel): void;
-export declare const cmsLogger: {
-    debug: (...args: any[]) => void;
-    info: (...args: any[]) => void;
-    warn: (...args: any[]) => void;
-    error: (...args: any[]) => void;
-};
+export declare function setLogger(logger: Logger): void;
+export declare const cmsLogger: Logger;
 //# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/utils/logger.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAQpE,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,QAE1C;AAoBD,eAAO,MAAM,SAAS;qBAjBJ,GAAG,EAAE;oBAAL,GAAG,EAAE;oBAAL,GAAG,EAAE;qBAAL,GAAG,EAAE;CAsBtB,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/utils/logger.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAEpE,MAAM,WAAW,MAAM;IACtB,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;CAC5B;AAOD,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,QAE1C;AA6BD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,QAEvC;AAED,eAAO,MAAM,SAAS,EAAE,MAKvB,CAAC"}

package/dist/utils/logger.js

@@ -1,5 +1,4 @@
 const LEVELS = { debug: 0, info: 1, warn: 2, error: 3, none: 4 };
-// Default based on environment; overridden by CMSConfig.logLevel via setLogLevel()
 let currentLevel = typeof process !== 'undefined' && process.env?.NODE_ENV === 'production' ? 'warn' : 'debug';
 export function setLogLevel(level) {
     currentLevel = level;
@@ -21,9 +20,19 @@ function createMethod(level, consoleFn) {
         }
     };
 }
-export const cmsLogger = {
+const defaultLogger = {
     debug: createMethod('debug', console.log),
     info: createMethod('info', console.log),
     warn: createMethod('warn', console.warn),
     error: createMethod('error', console.error)
 };
+let activeLogger = defaultLogger;
+export function setLogger(logger) {
+    activeLogger = logger;
+}
+export const cmsLogger = {
+    debug: (...args) => activeLogger.debug(...args),
+    info: (...args) => activeLogger.info(...args),
+    warn: (...args) => activeLogger.warn(...args),
+    error: (...args) => activeLogger.error(...args)
+};

package/dist/utils/mime-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mime-detect.d.ts","sourceRoot":"","sources":["../../src/lib/utils/mime-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuG5D;AAgED,MAAM,WAAW,qBAAqB;IACrC,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,qBAA0B,GACjC,oBAAoB,CA8EtB"}
+{"version":3,"file":"mime-detect.d.ts","sourceRoot":"","sources":["../../src/lib/utils/mime-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuG5D;AA2ED,MAAM,WAAW,qBAAqB;IACrC,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,qBAA0B,GACjC,oBAAoB,CAkFtB"}

package/dist/utils/mime-detect.js

@@ -110,7 +110,11 @@ const BLOCKED_MIME_TYPES = new Set([
     'application/x-shellscript',
     'application/wasm',
     'application/x-msdos-program',
-    'application/x-msdownload'
+    'application/x-msdownload',
+    'text/html',
+    'application/xhtml+xml',
+    'text/xml',
+    'application/xml'
 ]);
 /**
  * Blocked file extensions (regardless of MIME type).
@@ -144,18 +148,29 @@ const BLOCKED_EXTENSIONS = new Set([
     '.reg',
     '.inf',
     '.hta',
-    '.wasm'
+    '.wasm',
+    '.html',
+    '.htm',
+    '.xhtml',
+    '.shtml',
+    '.xml',
+    '.xsl',
+    '.mhtml'
 ]);
 /**
  * Validate an uploaded file's actual content against allowed types.
  * Checks magic bytes, not just the client-provided MIME type.
  */
 export function validateFile(buffer, filename, clientMimeType, options = {}) {
-    const ext = filename.toLowerCase().substring(filename.lastIndexOf('.'));
+    const lowerName = filename.toLowerCase();
+    const ext = lowerName.substring(lowerName.lastIndexOf('.'));
     const detectedMimeType = detectMimeType(buffer);
-    // 1. Block dangerous extensions
-    if (BLOCKED_EXTENSIONS.has(ext)) {
-        return { valid: false, error: `File type "${ext}" is not allowed`, detectedMimeType };
+    // 1. Block dangerous extensions (check all extensions to prevent double-extension bypass)
+    const allExts = lowerName.match(/\.[^.]+/g) || [];
+    for (const e of allExts) {
+        if (BLOCKED_EXTENSIONS.has(e)) {
+            return { valid: false, error: `File type "${e}" is not allowed`, detectedMimeType };
+        }
     }
     // 2. Block dangerous MIME types (detected from actual content)
     if (detectedMimeType && BLOCKED_MIME_TYPES.has(detectedMimeType)) {

package/dist/utils/reference-walk.js

@@ -30,6 +30,10 @@ function walk(value, ids) {
         ids.add(obj._ref);
         return;
     }
+    // Image/file fields store asset refs ({ _type:'image', asset:{_type:'reference', _ref} })
+    // that point to the assets table, not documents — skip them.
+    if (obj._type === 'image' || obj._type === 'file')
+        return;
     for (const key of Object.keys(obj)) {
         if (key.startsWith('_'))
             continue;

package/dist/vite/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/vite/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAElD,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,GAAG,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,MAAM,CAiF9D;AAiJD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,MAAM,EAAE,CAoB1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/vite/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAElD,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,GAAG,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,MAAM,CAiF9D;AAgJD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,MAAM,EAAE,CAoB1D"}

package/dist/vite/index.js

@@ -105,7 +105,9 @@ function aphexDayjsAlias() {
         name: 'aphex:dayjs-alias',
         config() {
             const dayjsEsm = require.resolve('dayjs/esm/index.js');
-            const dayjsEsmPluginDir = dayjsEsm.replace(/\/index\.js$/, '/plugin');
+            const dayjsEsmPluginDir = dayjsEsm
+                .replace(/\\index\.js$/, '\\plugin')
+                .replace(/\/index\.js$/, '/plugin');
             return {
                 resolve: {
                     alias: [
@@ -219,10 +221,7 @@ function aphexWatchUnfilter() {
             return {
                 server: {
                     watch: {
-                        ignored: [
-                            '!**/node_modules/@aphexcms/cms-core/**',
-                            '!**/node_modules/@aphexcms/ui/**'
-                        ]
+                        ignored: ['!**/node_modules/@aphexcms/cms-core/**', '!**/node_modules/@aphexcms/ui/**']
                     }
                 }
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aphexcms/cms-core",
-  "version": "8.0.0",
+  "version": "9.0.0",
   "description": "Aphex CMS Core - A Sanity-style CMS with ports and adapters architecture",
   "publishConfig": {
     "access": "public",
@@ -81,7 +81,7 @@
     "svelte": "^5.44.0",
     "tailwind-merge": "^3.4.0",
     "tailwind-variants": "^3.2.2",
-    "@aphexcms/ui": "0.7.0"
+    "@aphexcms/ui": "^0.8.0"
   },
   "peerDependenciesMeta": {
     "graphql": {
@@ -107,7 +107,6 @@
     "esbuild": "^0.27.0",
     "hono": "^4.12.15",
     "picocolors": "^1.1.1",
-    "s3mini": "^0.7.0",
     "sharp": "^0.34.5",
     "svelte-sonner": "^1.0.7",
     "tsx": "^4.20.6",
@@ -118,7 +117,7 @@
     "@eslint/js": "^9.39.1",
     "@internationalized/date": "^3.10.0",
     "@sveltejs/adapter-auto": "^7.0.0",
-    "@sveltejs/kit": "^2.49.0",
+    "@sveltejs/kit": "^2.59.1",
     "@sveltejs/package": "^2.5.6",
     "@sveltejs/vite-plugin-svelte": "^6.2.1",
     "@tailwindcss/vite": "^4.1.17",
@@ -135,7 +134,7 @@
     "tailwindcss": "^4.1.17",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.48.0",
-    "vite": "^7.2.4"
+    "vite": "^7.3.3"
   },
   "scripts": {
     "build": "svelte-package && tsc && node ../../scripts/fix-imports.js ./dist",